CVE-2018-10683 Auth bypass in n/a

Critical 9.8 Published 9 May 2018 Updated 5 Aug 2024

Attackers can access the WildFly server without authentication if the security realm is not configured, a state the vendor supports for development.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-10683?

CVE-2018-10683 is a critical authentication bypass vulnerability in n/a, published on 9 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a security realm reference" implies "effectively unsecured." The vendor explicitly supports these unsecured configurations because they have valid use cases during development

Weakness: CWE-287

Which versions are affected by CVE-2018-10683?

It affects 1 product.

Products include Redhat Wildfly.

How do I fix CVE-2018-10683?

No fix has been published for CVE-2018-10683 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-10683 being exploited?

There is no known exploitation of CVE-2018-10683 in the wild and no public exploit code.

Sources

Also known as GHSA-rw67-4595-c74r.